TF-MAL-py.lofy
📛 Threat Title
Malware family: Lofy
Description
ThreatFox malware family `py.lofy`. Printable name: Lofy. Aliases: LofyLife.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
py.lofy
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.lofy
IOC database
- Type
- domain
- Value
py.lofy- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-py.lofy
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.lofy
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:arxiv.org
Determining the family to which a malicious file belongs is an essential component of cyberattack investigation, attribution, and remediation . Performing this task manually is time consuming and requires expert knowledge. Automated tools using that label malware using antivirus detections lack accuracy and/or scalability, making them insufficient for real-world applications. Three pervasive ...
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Lofy malware family including references, samples and yara signatures.
-
web:research.jfrog.com
The author field ConsoleLofy contains the keyword Lofy , matching the closed dictionary of aliases used by the LofyGang threat group (documented by Checkmarx in October 2022).
-
web:threats.kaspersky.com
Malware , tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
-
web:windowsforum.com
Microsoft's March cumulative update for Windows 11, KB5079473 (released March 10, 2026), is rolling out with a familiar mix of new features and security fixes — but a growing number of users now say the patch is also triggering severe instability on some machines, including hard freezes...
-
web:www.bleepingcomputer.com
LofyGang's Discord channel (Checkmarx) A bot on Discord, named " Lofy Boost," can be used by channel members to purchase Nitro using a stolen credit card on behalf of the user.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.kodemsecurity.com
CVE-2026-31431, the Copy Fail Linux kernel LPE, lets authenticated users gain root. See affected kernels, exploit details, IOCs and patches.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:zero.checkmarx.com
LofyGang's hack tools also depend on malicious packages, which infect their operators with persistent hidden malware using the same capabilities as described above. For instance, we saw the tool "Discord-Mass-Dm" on GitHub, which depends on "small-sm" — one of LofyGang's malicious packages.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.